A veritable chicken: window. onerror cross-origin information leakage Vulnerability

5up3rh3iblog

A blog written by Chris Evans a few days ago :《Minor leak, major headacheIn fact, the window used in it. the onerror Cross-Domain Information Leakage Problem is a vulnerability that exists for n years... the last time I tested it in an archaeological activity, I always wanted to find an ideal solution. However, the tragedy is that no available files were found remotely or locally ....

A demo:Http://www.80vul.com/test/onerror.htmThe person who saw this for the first time must think that there is great potential for digging, but the tragedy is that there are many restrictions on reading the first line of the file... it is really difficult to find meaningful files that meet the conditions! So this vulnerability is a "real chicken ribs", but sb's google read actually uses so naked to save the token: http://www.google.com/reader/api/0/token [// should be patched], I finally found the shredded pork on the chicken ribs .....

I have carried out many tests on this vulnerability and have not found any valuable ones:

For example, to reference a file using vbs, <script language = "vbs" src = "onerror.txt">
For example, you can use uncpath to access local files.